KV store lookup as array

arunssd — Tue, 18 Feb 2025 11:34:37 GMT

I have a kv store lookup which populated automatically and it contains arrays . How can make it like a normal lookup that is searchable or how to make it as a proper file

current csv:

I want the above kv store as a searchable lookup with proper segregation between each rows

Re: KV store lookup as array

tscroggins — Sun, 23 Feb 2025 17:51:43 GMT

Hi @arunssd,

If 1) your KV store collection uses array fields, 2) all field values have a 1:1:1:1 relationship, and 3) there are no empty/missing/null values within a field, i.e. all array values "line up":

asn country maliciousbehavior riskscore 103.152.101.251 => PK => 3 => 9 103.96.75.159 => HK => 3 => 11 104.234.115.155 => CA => 4 => 9

you can transform the data with the transpose, mvexpand, and chart commands:

However, your results may be truncated by mvexpand if the total size of the in-memory result is greater than the limits.conf max_mem_usage_mb setting (default: 500 MB). See https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Bmvexpand.5D.

If this doesn't work for you, please share your collections.conf (KV store) and transforms.conf (lookup) settings. I used the following settings to test:

# collections.conf [arunssd_kv] field.asn = array field.country = array field.maliciousbehavior = array field.riskscore = array # transforms.conf [arunssd_kv] collection = arunssd_kv external_type = kvstore fields_list = asn,country,maliciousbehavior,riskscore

If your KV store fields are strings, the search can be adapted with the foreach and eval commands to coerce the fields values into a multi-valued type.

You can also transform the results from a shell using curl and jq or your scripting tools of choice.

topic Re: KV store lookup as array in Splunk Enterprise

KV store lookup as array

Re: KV store lookup as array